Configuration migration from Juniper SA2500 to the new PSA3000

[DI]

Hello Guys,

New to all this so please forgive me.l have been asked to migrate the configuration from the old Juniper SA2500 to the new PSA3000 appliance and wanted to ask here for the right processor or for any specifics that l should be aware of. Cannot open a KB below:

https://kb.pulsesecure.net/articles/Pulse_Secure_Article/how-to-migrate-configurations-from-an-existing-sa-x000-sa-x500-to-a-new-mag-device/?q=kb39994&l=en_US&fs=RelatedArticle

My understanding that old Juniper SA, MAG and new PSA are all running the same IVE OS. Am l right? Can I easy migrate configuration between different firmware releases e.g (8.2R1and 8.2R7).

Any advice or guidance would be appreciated.

Thank you,
Myky

[zanyterp]

Yes, you will need to export the user.cfg from the SA2500 and import it to the PSA3000
If you need to move the certificate, import this via the system.cfg at System>Configuration>Certificates>Device Certificates,import certificate

[DI]

Hello,

Thank you for coming back to me. So which file actually holds a system configuration: system.cfg or/and user.cfg?

Thank you,
Mykhaylo

[facusa]

Just to help out. as well, please refer to this document:

https://www.pulsesecure.net/download/techpubs/current/447/pulse-connect-secure/pcs/8.2rx/How_To_SA-MAG_to_PSA_Hardware_Upgrade-v4.pdf

Thanks, hope this helps.

[ruc]

Majority of the config is in user.cfg

System.cfg contains a few important details such as network settings, cluster settings, license settings, device certificate, snmp settings and syslog servers related settings

When moving from one hardware family to another the general recommendation is:

1. First prepare the destination device with network settings, license, etc (network settings at the very least)

2. Then import the binary system config using the 3rd import option (screenshot and details are here -
https://docs.pulsesecure.net/WebHelp/Content/PCS/PCS_AdminGuide_8.2/Importing%20a%20Binary%20System.htm )

3. Then allow the box to finish restarting services (will happen automatically)

4. Then import the binary user.cfg (this may take longer than step # 2 and #3 as its importing a lot more than system.cfg) however should typically finish within a couple of minutes.

This is the high level. Please refer to the the doc mentioned by 'facusa' for a more detailed version

[DI]

Thanks all

[Rattlehead.ie]

I hate resurrecting a very much dead thread but thought it better than a new one.

Is this still possible? 

I mean is the PSA3K is running 9.x and the old SA is 8.1?

Does the Juniper SA need to be upgraded first and or can it be upgraded past 8.1?

/Rattle

[Rattlehead.ie]

Hi guys,

Is this something thats still doable? 

I mean if you have a PSA3K running 9.1 and a Juniper SA2500 running 8.1? 

Does the SA2500 need s/w upgrade first? If so how, I was under the impression that the SA2500 only goes to 8.1?

I have tried importing the system.cfg file directly onto the new PSA3K and once done it I see no evidence of the config having been applied. User auth is done via AD on the old SA2500.

[zanyterp]

@Rattlehead.ie: yes, you can still migrate from the SA to the new platforms
the SA cannot be upgraded beyond 8.1 (possibly not even past 7.1 or 8.0 for the 2500, IIRC)

[zanyterp]

you should not see anything imported from the system.cfg; to see changes, you will need to import the user.cfg. the user.cfg has realms, roles, ACLs, and all the configuration that you do not want to lose